Privacy commissioner stresses importance of protecting sensitive information on children
The Office of the Privacy Commissioner (OPC) has publicly released a compliance notice issued to Oranga Tamariki – Ministry for Children based on failures to abide by the requirements of the Privacy Act 2020.
“Oranga Tamariki currently doesn’t have sufficiently robust systems and practices in place to appropriately protect the personal information it holds, as required under the Privacy Act, and there is ongoing likelihood of further privacy breaches,” said Michael Webster, privacy commissioner, in a news release from the OPC.
The compliance notice against the ministry arose after Webster learned of a series of privacy breaches concerning the storage, security, and unauthorised disclosure of personal information that led to serious harm to whānau and tamariki, according to the OPC’s news release.
“I consider the notifiable privacy breaches reported to my Office and the systemic privacy issues identified in an independent review to be significant,” Webster said in the news release. “This is because the sensitivity of the personal information involved and the vulnerability of the individuals the information relates to is at the high end of seriousness.”
The OPC shared that the compliance notice required Oranga Tamariki to enhance staff skills and capability and otherwise improve its privacy performance relating to information access settings, the oversight of service providers, and the accountability and reporting of privacy incidents by 31 March 2026.
The OPC started investigating Oranga Tamariki in 2022, suggested that it commission an independent review of its privacy practices and culture in May 2023, and completed an April 2024 report that found systemic failures in the ministry’s handling of sensitive personal information.
“In response to that review, Oranga Tamariki has taken steps to improve their privacy practices, including undertaking a privacy improvement plan, and this is a positive move towards helping keep sensitive information about the children they care for safe,” Webster said in the news release.
However, Webster stressed that the ministry could benefit from much more improvement.
In the OPC’s news release, Webster emphasised the importance of Oranga Tamariki’s work, which seeks to protect the children in the ministry’s care and young people in New Zealand more broadly.
“Improving its privacy practices will contribute to the safety and wellbeing of children, their whānau, caregivers, and foster parents,” Webster said in the news release.
Webster explained that transparency regarding the requirements in the OPC’s compliance notices serves the public interest, promotes accountability, and helps ensure that entities like Oranga Tamariki will take the steps they need to address their shortcomings.
“We are all invested in the safety of the children in Oranga Tamariki’s care, and keeping sensitive information about children safe is critical,” Webster said in the news release.
